LDAP Authentication Filter \ Usage

I am trying to setup LDAP authentication with our AD environment.

` basicAuthentication.enabled=true #basicAuthentication.realm=“Kafka-Manager” #basicAuthentication.username=“admin” #basicAuthentication.password=“password” basicAuthentication.excluded=[“/api/health”] # ping the health of your instance without authentification

basicAuthentication.ldap.enabled=true basicAuthentication.ldap.server=“ad-server.domain.local” basicAuthentication.ldap.port=389 basicAuthentication.ldap.username=“CN=Kafka Service,OU=Kafka,OU=Prod,OU=Service,DC=Domain,DC=local” basicAuthentication.ldap.password=“password” basicAuthentication.ldap.search-base-dn=“dc=domain,dc=local” basicAuthentication.ldap.connection-pool-size=10 basicAuthentication.ldap.ssl=false `

For the search filter (which I think is where my issue is), I’ve tried a few different ways: basicAuthentication.ldap.search-filter="(uid=$capturedLogin$)" basicAuthentication.ldap.search-filter="CN=Kafka Admins,OU=Groups,OU=Prod,OU=Service,DC=Domain,DC=local" and basicAuthentication.ldap.search-filter="(&(cn=%u)(memberOf=CN=Kafka Admins,OU=Groups,OU=Prod,OU=Service,DC=Domain,DC=local))" No matter what I try I end up in a login loop (no error), and do not believe it is querying the account from the group in the search filter properly. I’ve enabled DEBUG logging and it does not output anything at all.

I also feel like there should be a setting for me to associate the sAMAccountName or userPrinipalName from the users attributes.

Thanks for any help here!

[atharvai]

I’m using v3.0.0.5 and this still doesn’t work. it also would be nice if the logs printed out errors for LDAP. Is there a version where group filter works and prints error logs?

[yumupdate]

Hi,

Don’t know if it could help but after 1 day of struggle with ldap I’m finaly able to restrict access to a group named kafka-manager in FreeIPA LDAP on CentOS:

basicAuthentication.ldap.enabled=true
basicAuthentication.ldap.server="server.domain.local"
basicAuthentication.ldap.port=389
basicAuthentication.ldap.username="uid=admin,cn=users,cn=compat,dc=domain,dc=local"
basicAuthentication.ldap.password="******"
basicAuthentication.ldap.search-base-dn="dc=domain,dc=local"
basicAuthentication.ldap.search-filter="(&(uid=$capturedLogin$)(memberOf=cn=kafka-manager,cn=groups,cn=accounts,dc=domain,dc=local))"
basicAuthentication.ldap.connection-pool-size=10
basicAuthentication.ldap.ssl=false

For Windows Active Directory, replace uid=$capturedLogin$ by sAMAccountName=$capturedLogin$ Thank you! sAMAccountName=$capturedLogin$ worked for me